GDPR is extra-territorial and its rights apply to EU citizens wherever they are in the world
if a EU user is in the US ON HOLIDAY! and they're using your service, you're subject to the GDPR
(in theory)
if a EU user is in the US ON HOLIDAY! and they're using your service, you're subject to the GDPR
(in theory)
A bit more unclear situation is if non-resident is visiting EU and uses services from their home country.
given "within the Union" is used separately in the next sub-article to mean physically located within, it's arguable that "in the Union" could mean citizen of